iOS Signing

iOS production builds need a distribution certificate, a provisioning profile, and a .p12 export — all matching your Apple Developer team. Venelx supports four ways to supply these, plus an Import from Expo shortcut. Configure them in the dashboard under your project → Signing → iOS.

The four methods

1. App Store Connect API key (recommended)

Upload an App Store Connect (ASC) API key: Issuer ID, Key ID, and the .p8 private key file (created in App Store Connect → Users and Access → Integrations → App Store Connect API).

Once an ASC API key is saved, Venelx auto-provisions and renews everything at build time — distribution certificate, provisioning profile, and the .p12 — much like EAS Build does. Expired or revoked certificates and profiles are recreated automatically before the build starts, so signing stops being a maintenance task.

2. Apple ID

Sign in with your Apple ID email and password (use an app-specific password when two-factor authentication is enabled). Venelx uses it (via fastlane) to provision certificates and profiles on demand. You may be prompted to complete a 2FA challenge during setup.

3. Fastlane session

For accounts where interactive 2FA isn't practical, paste a FASTLANE_SESSION cookie (generated locally with fastlane spaceauth). Venelx uses the session for provisioning calls. Sessions expire — when one does, generate a fresh one and update the credential.

4. Manual upload

Bring your own material and upload it directly:

• .p12 — the distribution certificate + private key export (with its password)
• .mobileprovision — the provisioning profile for your app's bundle ID
• an additional profile for each app extension (see below)

You own renewal with this method: when the certificate or profile expires, upload replacements or production builds start failing.

Import from Expo

Already building with EAS? Import from Expo pulls the credentials EAS stores for your project (distribution certificate, provisioning profile) into Venelx, so you can switch build infrastructure without re-enrolling anything with Apple.

Things worth knowing

Apple's 3-distribution-certificate team limit

Apple allows at most 3 active distribution certificates per team. Venelx reuses an existing valid certificate whenever possible; if your team is at the limit and none can be reused, provisioning fails until you revoke an unused certificate (in the Apple Developer portal) or import/match an existing one.

Share-extension profiles

If your app ships a share extension (or another app-extension target), the extension has its own bundle ID and needs its own provisioning profile in addition to the main app profile. With the ASC API key method Venelx provisions both; with manual upload you must upload both profiles or the archive step fails on the extension target.

Profile ↔ p12 fingerprint check

Before a build signs anything, Venelx verifies that the certificate embedded in the provisioning profile and the certificate inside the .p12 are the same identity — compared by SHA fingerprint. A mismatch fails the build early with a clear error instead of producing a broken archive at the end of a 30-minute pipeline. Fix it by uploading a matching pair, or by letting auto-provisioning (ASC API key) regenerate both.